Sida loogu xidho hal app Linux VPN adigoo isticmaalaya xeerar UID

Hal barnaamij ku xidhista VPN Linux waa inta badan dhibaato dariiq, oo xeerka firewall-ku wuxuu go'aamiyaa oo kaliya waxa dhaca ka dib marka dariiqa la doorto. Haddii aad UID-ga barnaamijka ku barbardhigtid OUTPUT ka hor inta uusan tunnel-ku lahaan dariiqa caadiga ah, xeerku wuxuu tuurayaa isla taraafikii aad rabtay inaad ilaaliso. Isla xeerkaas ma arko habka resolver-ka ee ka jawaaba su'aalaha DNS ee barnaamijka. Hagaaji nidaamka, oo hal xisaab oo aan mudnaan lahayn wuxuu noqdaa doorasho lagu kalsoonaan karo oo tunnel-ka qaybsan.

Xisaabta sii dariiq ka hor xukunka

Iskudhigma milkiilaha wuxuu ka jawaabaa hal su'aal: socket maxalli ah oo UID-kan leh ayaa dhisay baakadda? Ma dooranayo interface, mana rari karo taraafik kaas oo shaxda ugu weyn ay horey ugu diraysay NIC jireed. Taasi waa sababta xeerka UID oo aan lahayn dariiq u dhigma uu barnaamijka u xannibo halkii uu u leexin lahaa.

Marka hore xisaabta mari shaxdeeda, ka dibna u dhaaf firewall-ka inuu natiijada xaqiijiyo. Tani waxay ku shaqaysaa host ay iproute2-kiisu fahanto uidrange, taas oo ip rule help ku soo sheegto hal sadar. Shaxda 100 waxay haysaa dariiq caadi ah oo tunnel-ka mara, xeerkaana wuxuu kaliya UID 1000 u diraa shaxdaas. Wax kasta oo kale waxay ku sii ahaanayaan shaxda ugu weyn oo waxay sii isticmaalaan xiriirka jireed.

ip rule add uidrange 1000-1000 table 100
ip route add default dev tun0 table 100

Xisaabta labaad oo u baahan tunnel kale waxay heshaa shaxda 101 iyo xeerkeeda, sababtoo ah laba profile ma yeelan karaan dariiqa caadiga ah isla shax wadaag. Profile-yada NetworkManager waa nidaam-ku-salaysan, sidaas darteed qaybtan gacanta ayay ku sii ahaanaysaa, xeerraanna way lumaan marka dib loo bilaabo haddii aan waxba soo celin. Ku qor shaxaha skript-ka boot-ka ee agagaarka qeexitaanka tunnel-ka, si dib-u-xiriirku uusan hal xisaab ugu tegin dariiqa khaldan.

Sababta ka reebista loopback ay u dishaa tunnel-ka

Inta badan nuqulada xeerka ee la koobiyeeyay waxay tuurayaan baakad kasta oo aan ka soo bixin loopback. Tunnel-ku ma aha loopback, sidaas darteed qaabkaas wuxuu tuurayaa taraafikii tunnel-kaba, natiijaduna waxay u muuqataa sida VPN dhintay ee ma aha khalad firewall.

Marka OUTPUT uu socdo, kernel-ku horey ayuu u doortay interface-ka bixitaanka, sidaas darteed -o waxaa lagu barbardhigayaa jawaabta dariiqa ee ma aha madaxa baakadda. Barbardhigga milkiilaha waxaa lagu tixgeliyaa kaliya OUTPUT iyo POSTROUTING, baakadaha la gudbiyayna ma qaadaan socket uu akhriyo. Isku-dhafkan macnaheedu waa in ka reebistu ay tahay inay magacowdo interface-ka tunnel-ka oo ay diido barbardhiggaas, ee ma aha inay diido loopback.

Loopback weli wuxuu mudan yahay ACCEPT u gaar ah oo ka sarreeya DROP, sababtoo ah baakadda DNS ee ugu horreysa ee barnaamijka waxay u tagtaa stub maxalli ah iyada oo maraysa lo. Dhig labada xeerar nidaamkan, xisaabtuna waxay gaartaa stub-ka, ka dibna tunnel-ka, oo meel kale ma gaadho.

iptables -I OUTPUT 1 -o lo -m owner --uid-owner vpnapp -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner vpnapp ! -o tun0 -j DROP

IPv6 waa xeerar gooni ah, lammaanaha kaliya v4-na wuxuu ka tagaa ip6tables isagoo aan la taaban. Barnaamijka doorbida diiwaanka AAAA wuxuu markaas ka bixi lahaa xiriirka jireed isagoo aan waligiis gaarin DROP. Ka tarjum labada xeerar ip6tables, ama dami IPv6 host-ka marka tunnel-ku uusan qaadanin cinwaan v6. Xeerraha gacanta lagu darayna way lumaan marka dib loo bilaabo, sidaas darteed ku kaydi netfilter-persistent save ama dib u dhis isla macquulkaas sida shax nftables oo ay rartaa unugga boot-ka.

Jawaabaha DNS waxay ka yimaadaan hab kale

Su'aasha barnaamijka ee 127.0.0.53 waxay dhaafataa ACCEPT-ka loopback, oo halkaas ayuu iskudhigma UID-ga joogsadaa. Stub resolver-ku wuxuu kor u diraa xisaabtiisa adeeg, sidaas darteed xeer ku xidhan vpnapp waligiis ma arko su'aasha labaad. Haddii resolver-ku u doorto server LAN xiriirka, jawaabuhu waxay ku soo noqdaan NIC jireed halka baakadaha barnaamijka laftiisu ay ku sii jiraan tunnel-ka. Natiijada muuqata waa tunnel shaqaynaya oo magacyo jajaban leh, ama magacyo uu ka jawaabo server aadan dooran.

Hagaaji xallinta magacyada xiriirka tunnel-ka, ee ma aha barnaamijka. Sii profile-ka tunnel-ka server DNS iyo domain dariiq, ka dibna ku xaqiiji resolvectl query iyo resolvectl status tun0 in resolver-ku u isticmaalo magacyada muhiimka ah. Gudaha booska magacyada shabakadda dhibaatadu way baaba'daa, sababtoo ah resolver-ka boosku wuxuu yaqaan oo kaliya tunnel-ka.

Xeerka ka hubi xisaabta lafteeda

Weydii kernel-ka dariiq kee ay UID hesho, ka dibna codsi samee adigoo ah xisaabtaas oo barbardhig cinwaanka bixitaanka midka xisaabtaada. Haddii labaduba isla cinwaan sheegaan, xeerku wuxuu la mid yahay wax kale oo aan ahayn taraafikii aad tijaabisay. Amarka ugu horreeya ee hoose wuxuu muujinayaa raadinta dariiqa isagoo aan dirin baakad, taas oo kala soocda khalad dariiq iyo khalad firewall.

ip route get 1.1.1.1 uid 1000
sudo -u vpnapp curl -s https://ifconfig.co

Tirakoobku waxay muujinayaan haddii xeer waligiis kiciyay. Socodsii iptables -vnL OUTPUT, akhri tirada baakadaha agagaarka xeer kasta, oo eber agagaarka DROP ka dib taraafik dhab ah u qaado khalad iskudhig.

Taraafikka la gudbiyo wuxuu ka baxsan yahay naqshaddan. Konteyner ama VM ka dambeeya buundo ma laha socket maxalli ah oo uu leeyahay vpnapp, sidaas darteed iskudhigma milkiilaha waligiis ma kiciyo oo baakadahaas waxay raacaan siyaasadda FORWARD. Haddii shaqadaas lagu dabooli lahaa, si gooni ah u tijaabi oo qor siyaasad ku xidhan buundada ama cinwaanka konteynerka. Naqshaddu waxay taagan tahay marka shaxda, ka reebista interface-ka, resolver-ka iyo xeerarka v6 ay dhammaantood isku jiho tilmaamaan; midkoodna ka tag oo xisaabtu way daadanaysaa ama xiriirka way luminaysaa.